By default, WordPress spawns the cron runner using an HTTP request to itself. Such a request is quite a bit of overhead for the original user-facing request, usually about 1 second. This means that every once in a while (when cron needs to run), regardless of how fast your application is, the response time for an unlucky user will suck.